Function signWithGoogle

apps/api/src/services/auth/utils.py:96–196

(
    request: Request,
    access_token: str,
    email: str,
    org_id: Optional[int] = None,
    current_user=Depends(get_current_user),
    db_session: AsyncSession = Depends(get_db_session),
)

async def signWithGoogle(
    request: Request,
    access_token: str,
    email: str,
    org_id: Optional[int] = None,
    current_user=Depends(get_current_user),
    db_session: AsyncSession = Depends(get_db_session),
):
    # Google
    google_user = await get_google_user_info(access_token)

    # SECURITY: trust only the email Google returns *and* explicitly marks as
    # verified. Previously this fell back to the body-supplied ``email`` when
    # Google omitted it (which happens whenever the access token was minted
    # without the ``email`` scope), letting an attacker with any valid Google
    # token impersonate any LearnHouse user whose address they knew. The body
    # ``email`` field is kept in the request schema for backward compatibility
    # but is no longer used for identity resolution.
    google_email = google_user.get("email")
    google_email_verified = google_user.get("email_verified")
    if not google_email or not google_email_verified:
        raise HTTPException(
            status_code=401,
            detail="Google did not return a verified email for this account",
        )
    # Normalise to lower-case to match the DB unique-ish invariant on email.
    user_email = google_email.strip().lower()

    user = (await db_session.execute(
        select(User).where(User.email == user_email)
    )).scalars().first()

    if not user:
        # Extract user data with safe defaults
        given_name = google_user.get("given_name", "")
        family_name = google_user.get("family_name", "")
        picture = google_user.get("picture", "")

        # Generate username more robustly
        username_parts = []
        if given_name:
            username_parts.append(given_name)
        if family_name:
            username_parts.append(family_name)

        # If no name parts available, use part of email
        if not username_parts and user_email and "@" in user_email:
            email_prefix = user_email.split("@")[0]
            if email_prefix:  # Make sure it's not empty
                username_parts.append(email_prefix)

        # If still no parts, use a default
        if not username_parts:
            username_parts.append("user")

        username = "".join(username_parts) + str(random.randint(10, 99))

        user_object = UserCreate(